Enhanced Blocks – Page Builder Blocks for Gutenberg Security & Risk Analysis

The "enhanced-blocks" plugin v1.4.1 presents a mixed security posture. While the static analysis indicates no dangerous functions, all SQL queries use prepared statements, and there are no file operations or external HTTP requests, there are significant concerns. The plugin exposes two AJAX handlers, both of which completely lack authentication checks. This is a critical oversight that could allow unauthenticated users to trigger plugin functionality, potentially leading to unauthorized actions. The vulnerability history also shows a pattern of missing authorization, with a currently unpatched medium severity vulnerability. This historical trend reinforces the concerns raised by the static analysis regarding the lack of proper authorization checks.